Cryptojacking: When Your Website Is Quietly Mining Someone Else's Coins

Most compromises announce themselves eventually. Spam pages appear in search, visitors get redirected, Google shows a warning. There is a moment where you find out.

Cryptojacking is different. There is no moment. The site keeps working, nothing looks wrong, and the only symptoms are that everything feels slower and the hosting bill crept up.

What is actually happening

Cryptocurrency mining requires computing power, and computing power costs money. Cryptojacking solves that by using someone else's.

There are two variants, and they steal from different people.

Server-side mining. A script runs on your hosting, using your CPU allocation continuously. You pay for it in resources, slow pages, and eventually a suspension when the host notices.

Browser-based mining. JavaScript injected into your pages runs in your visitors' browsers. Their laptops get hot and their batteries drain while they read your site. You pay for it in reputation.

Plenty of infections do both.

Unlike most malware, this one benefits from your site staying online and working normally. Breaking it would end the revenue.

Why it goes unnoticed for so long

The economics push attackers toward subtlety. A defaced site gets fixed within hours. A site quietly mining for eight months is far more profitable.

So the scripts are written to avoid attention. Many throttle themselves to use only a portion of available CPU. Some pause when they detect developer tools are open. Others only activate outside business hours, so the site is fast whenever you happen to check it.

The result is a compromise that can run for the better part of a year.

The symptoms

Individually these look like ordinary performance problems. Together they are a pattern.

• The site got slower without any content or plugin changes
• Your host mentions high CPU usage, or you keep hitting resource limits
• The hosting bill increased on a usage-based plan
• Visitors report their device getting hot or fans spinning up
• Ad blockers or antivirus flag your site, which is often how owners first hear about it
• Server load is high overnight when traffic should be near zero

That last one is the most reliable single indicator. Genuine traffic follows a daily rhythm. Mining does not.

How to check

Look at your resource graphs

Open your hosting panel and find CPU usage over the last month. You are looking for a flat elevated line rather than peaks that follow your traffic. Compare CPU usage against visitor numbers — if CPU is high when traffic is low, something is running that is not serving visitors.

Check what your pages load

Open your site in a private window, then open developer tools and look at the Network tab. Every script your page requests is listed. Look for connections to domains you do not recognise, particularly ones still active after the page finishes loading.

Also watch the Performance tab or your system monitor. A page sitting idle should use almost no CPU. If it is consuming 30% while doing nothing visible, that is your answer.

Search your files

Mining scripts are usually obfuscated, but they leave traces. Search your files and database for coinhive, cryptonight, webminer, miner, and the usual obfuscation markers eval(, base64_decode and atob(.

Also check for processes you did not start, and scheduled tasks in cron that restart something periodically.

Check outbound connections

Mining requires talking to a mining pool. If your host can show you outbound connections, persistent traffic to an unfamiliar address on an unusual port is close to conclusive.

Removing it

The clean-up follows the standard process in our guide to removing malware from WordPress, with two additions specific to this infection.

Kill the running process first. Unlike file-based malware that only runs when a page loads, server-side miners often run continuously as a background process. Deleting the file does not stop what is already running — the process must be terminated, which usually needs your host.

Check cron thoroughly. Miners are frequently reinstalled by a scheduled task. Check both WordPress cron and system-level cron. If the miner returns within hours of removal, this is why.

Then the usual: replace core files, reinstall themes and plugins from official sources, clean the database of injected scripts, find every backdoor, rotate all credentials, and regenerate the security keys in wp-config.php.

The costs

Easy to underestimate because there is no dramatic incident.

You pay in hosting resources, directly on usage-based plans and indirectly through throttling and suspensions elsewhere. Your visitors get a slow site, which costs conversions and search rankings. Being flagged by antivirus vendors or ad blockers damages trust and takes work to reverse.

And underneath all of it, someone has had persistent access to your server for months. Mining may not be the only thing they did with it.

That last point matters most

It is tempting to treat cryptojacking as a nuisance — annoying, expensive, but not really dangerous. That is the wrong conclusion.

The access required to install a miner is the same access required to read your database, take customer data, or install a card skimmer. The attacker chose mining because it was the easiest money, not because it was all they could do.

Treat it as a full compromise. If you hold customer data, that includes considering your obligations under GDPR or PDPL.

Catching it early

This is close to the ideal case for monitoring, because the infection is designed to be invisible to a human but is obvious to a machine.

File integrity checks catch the injected script within hours of it appearing. Resource monitoring flags the CPU pattern immediately. Neither depends on anyone noticing that the site feels a bit sluggish.

Our security monitoring service covers both, with a person reading the alerts rather than a dashboard nobody opens.

If your site has slowed down for no reason

Most of the time an unexplained slowdown is mundane — an unoptimised image, a heavy plugin, hosting that has been outgrown. Our guide to why WordPress sites get slow covers those.

But if the CPU graph does not match your traffic, it is worth checking properly. Our security and error fixing service can tell you which it is.

Send us your web address and anything your host has said about resource usage.